For Cloudflare Enterprise teams
Bots adapt. Your rules should too.
We close the gap between what Bot Management detects and what your rules actually stop, in week one. Then we keep your rules ahead of bots as they rotate fingerprints, networks and user agents.
Read-only access. We never change your Cloudflare account.
(http.request.uri.path contains "/login" and http.request.method eq "POST" and cf.bot_management.score lt 30 and not cf.bot_management.verified_bot)
Detected is not stopped.
Bot Management scores traffic well. But most teams keep their bot rules in log mode, because nobody can say which rule is safe to enforce. The bots are seen, recorded and let through.
How it works
Two weeks to close the gap. Then we keep it closed.
- Week 1
Audit
How much automated traffic reaches you, how much your rules stop, which endpoints are exposed, and how your existing rules perform.
- Week 1
Tested rules
Draft rules, each replayed against your last 7–30 days of traffic: what it would have matched, and how much of that looks human.
- Week 2
Staged rollout
You deploy the rules you choose in log mode. We review each one and tell you when to move it to a challenge, to a block, or back.
- Every month after
Adaptation
When rules start to bite, bots change identity. We watch for it, prepare rules before the volume arrives, and retire rules that stop working.
Rollout
No rule goes straight to block.
Each rule climbs one step at a time, and only on evidence from your own traffic. You can switch any rule back to log yourself, at any moment.
Watch
The rule records what it would have stopped. Nobody is affected.
Moves on when few of the matched visitors behave like people.
Ask
Matched visitors get a challenge. People pass it; most bots do not.
Moves on when fewer than 1% solve it. Rolls back above 20%, or if logins or checkouts drop.
Stop
Matched requests are refused. Every block rule expires and is renewed only with fresh evidence.
Rolls back on any breach of the business limits you set.
After week two
Stopping bots once is easy. Staying ahead is the work.
Once a rule bites, operators rotate: a new fingerprint, a new network, a new user agent. We let harmless probes through on purpose, because they show us the next identity before the volume arrives. Probes that do harm on their own, like card testing or credential checks, are challenged on sight.
Reported every month
Escape rate
Of the bot traffic stopped, how much came back under a new identity and got through.
Time to adapt
From a rotation appearing to a rule covering it.
Rule health
Rules that still match, expired on time, or were rolled back.
Collateral
Challenge solve rates, logins and checkouts, kept within the limits you agree with us.
Your data
Read-only, one zone, and it expires.
You create an API token that can only read analytics for the zone we audit, with an end date. It cannot change a setting, a rule or a DNS record.
| Data | Where it stays |
|---|---|
| Your API token | Our machine's keychain. Never in a file, an email or a chat. |
| IP addresses, user agents, paths, fingerprints, rule IDs | Files on our machine only, deleted within 30 days of the pilot ending. |
Ratios, ranges and labels such as path-3fa9c1 | Our analysis notes, and the AI assistant we use for analysis. It never sees your token or any identifier. |
We sign an NDA and a data processing agreement before you send a token, and share the full pilot runbook on the first call.
Start with a two-week pilot.
Built for teams on Cloudflare Enterprise with Bot Management, especially in retail, ticketing, travel, betting and fintech, where logins, checkouts and inventory are under constant pressure.
Or write to contact@counterdrift.io
In the first call we ask
Which plan you are on, and whether you have Bot Management
How many of your bot rules only log today
Who owns WAF changes, and how fast one can ship
What hurts most: credential stuffing, scraping, inventory or fake sign-ups